From: Paul Semel <semelpaul@gmail.com>
Date: Fri, 23 Feb 2018 22:48:57 +0000 (+0100)
Subject: fuzz/x86_emulate: fix bounds for input size
X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~488
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=256386f75d50772f23a7e950b3fa0ebb32ea96b9;p=xen.git

fuzz/x86_emulate: fix bounds for input size

The maximum size for the input size was set to INPUT_SIZE, which is actually
the size of the data array inside the fuzz_corpus structure and so was not
abling user (or AFL) to fill in the whole structure. Changing to
sizeof(struct fuzz_corpus) correct this problem.

Signed-off-by: Paul Semel <semelpaul@gmail.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
---

diff --git a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
index 964682aa1a..0ada613f52 100644
--- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
+++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
@@ -33,6 +33,7 @@ struct fuzz_corpus
     unsigned char data[INPUT_SIZE];
 } input;
 #define DATA_OFFSET offsetof(struct fuzz_corpus, data)
+#define FUZZ_CORPUS_SIZE (sizeof(struct fuzz_corpus))
 
 /*
  * Internal state of the fuzzing harness.  Calculated initially from the input
@@ -828,7 +829,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size)
         return 1;
     }
 
-    if ( size > INPUT_SIZE )
+    if ( size > FUZZ_CORPUS_SIZE )
     {
         printf("Input too large\n");
         return 1;
@@ -859,8 +860,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size)
 
 unsigned int fuzz_minimal_input_size(void)
 {
-    BUILD_BUG_ON(DATA_OFFSET > INPUT_SIZE);
-
     return DATA_OFFSET + 1;
 }